Application running method and device, terminal, storage medium and program product

Abstract

The invention provides an application running method and device, a terminal, a storage medium and a program product. The method belongs to the technical field of application operation and comprises the steps that in response to starting operation on a first application, a first permission category to which a first application permission corresponding to the first application belongs is obtained, and the first application permission refers to the permission of the first application for accessing system resources; a first process corresponding to the first permission category is determined, first process permissions of the first process are application permissions contained in the first permission category, and applications of different permission categories run in different processes; and running the first application in the first process. According to the method, the process permission and the engine permission in the application running process can be limited, the leakage risk of user data is reduced, and the safety of terminal system resources is improved.

Description

Technical Field

[0001] The present application relates to the field of application operation technology, and more specifically, to an application operation method, device, terminal, storage medium and program product in the field of application operation. Background Art

[0002] There are three types of APP development modes on terminals with Android system: native APP, WEB APP and hybrid APP. Among them, WEB APP can be used without installation, and is mainly interpreted and executed in the JS engine on the terminal in the form of JS code. For example, quick applications and mini programs are all WEB APPs.

[0003] At present, the terminal system is pre-installed with a WEB APP platform for the execution of WEB APP. During the use of WEB APP, after the user triggers the WEB APP, the WEB APP platform will create an independent process for it to execute the JS engine corresponding to the JS code of the WEB APP, the WEB APP permission control module, and other necessary auxiliary modules. Moreover, multiple WEB APPs can be run simultaneously in the same process.

[0004] Since the code in the same process can share permissions, the process permissions of the same process are the collection of application permissions owned by all WEB APPs running in it. The scope of process permissions is too large, which increases the risk of system resource leakage. Summary of the invention

[0005] The present application provides an application running method, device, terminal, storage medium and program product, which can reduce the risk of user data leakage during application running and improve the security of terminal system resources.

[0006] In one aspect, a method for running an application is provided, the method comprising:

[0007] In response to an operation of opening a first application, obtaining a first permission category to which a first application permission corresponding to the first application belongs, where the first application permission refers to permission for the first application to access system resources;

[0008] Determine a first process corresponding to the first permission category, where the first process permission of the first process is the application permission included in the first permission category, and applications of different permission categories run in different processes;

[0009] The first application is run in the first process.

[0010] In one aspect, an application running device is provided, the device comprising:

[0011] A first acquisition module, configured to, in response to an opening operation on a first application, acquire a first permission category to which a first application permission corresponding to the first application belongs, wherein the first application permission refers to permission for the first application to access system resources;

[0012] a determination module, configured to determine a first process corresponding to the first permission category, wherein the first process permission of the first process is the application permission included in the first permission category, and applications of different permission categories run in different processes;

[0013] A running module is used to run the first application in the first process.

[0014] On the one hand, a terminal is provided, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, the terminal executes the application running method described in any one of the above aspects.

[0015] On the one hand, a computer-readable storage medium is provided, in which instructions are stored. When the instructions are executed on a computer or a processor, the computer or the processor executes the application running method described in any one of the above aspects.

[0016] On the one hand, a computer program product is provided, which computer program product or computer program includes a program code, which is stored in a computer-readable storage medium. A processor of a terminal reads the program code from the computer-readable storage medium, and the processor executes the program code, so that the terminal executes the application running method described in any one of the above aspects.

[0017] The technical solution provided in the embodiments of the present application can bring the following beneficial effects:

[0018] The present application provides an application running method that can limit process permissions: when the terminal receives an opening operation for the first application, the first permission category to which the first application permission belongs corresponding to the first application can be obtained, and the first process corresponding to the first permission category can be determined to control the first application to run in the first process corresponding to the first permission category, so that applications of the same permission category are run in the same process, and applications of different permission categories are run in different processes, so that the process permissions of the same process are limited to the application permissions contained in the same permission category. Compared with the related art that does not limit the application running in the process, the application running method provided by the present application can reduce the process permissions of the process from the application permissions corresponding to multiple permission categories to the application permissions corresponding to a single permission category. Similarly, the engine permissions of the engine in the process can also be reduced from the application permissions corresponding to multiple permission categories to the application permissions corresponding to a single permission category, achieving the purpose of limiting process permissions and engine permissions during application operation, reducing the risk of user data leakage, and improving the security of terminal system resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 is a schematic flow chart of an application running method provided in an embodiment of the present application;

[0021] Figure 2 is a schematic flow chart of another application running method provided in an embodiment of the present application;

[0022] Figure 3 is a schematic flow chart of another application running method provided in an embodiment of the present application;

[0023] Figure 4 It is a schematic diagram of the principle of an application running process provided by an embodiment of the present application;

[0024] Figure 5 is a schematic flow chart of another application running method provided in an embodiment of the present application;

[0025] Figure 6 It is a structural diagram of an application running device provided in an embodiment of the present application;

[0026] Figure 7 It is a structural diagram of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The technical solutions in the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, "multiple" means two or more than two. The terms "first" and "second" are used for descriptive purposes only and should not be understood as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0028] There are currently three types of application (APP) development modes, namely native APP, WEB APP and hybrid APP. Among them, WEB APP can be used without installation, and is mainly interpreted and executed in the JS engine on the terminal in the form of scripting language (JavaScript, JS) code. For example, quick applications, mini programs, etc. can all be called WEB APPs.

[0029] The terminal is pre-installed with a WEB APP operating platform (Platform) before leaving the factory, which is used to provide an operating environment for the WEB APP. The corresponding WEB APP operating process is summarized as follows:

[0030] (1) During the operation of the terminal, the WEB APP operation platform is resident in the terminal system to respond to the user's start-up of the WEB APP in a timely manner.

[0031] (2) When the user triggers WEB APP1, the WEB APP running platform creates an independent process 1 (process1), which includes a JS engine (the JS engine is used to interpret and execute the JS code of WEB APP1), a permission control module (or permission control service), and other necessary auxiliary modules for supporting the operation of WEB APP1.

[0032] (3) process1 obtains the JS code of WEB APP1 from the WEB APP application store.

[0033] (4) The JS engine in process1 interprets and executes the JS code of WEB APP1 and remotely communicates with the background server of WEB APP1.

[0034] (5) When WEB APP1 needs to access certain system resources on the terminal, that is, call certain application programming interfaces (APIs) of the terminal system, such as microphone, camera, photo album, etc., WEB APP1 calls the relevant interfaces of the JS engine.

[0035] (6) The JS engine queries the WEB APP permission control module to see whether WEB APP1 has the corresponding permission to access terminal system resources (the permissions of the WEB APP are manually configured by the user, or there are certain permission policies in the webapp_platform).

[0036] If WEB APP1 has the corresponding permissions, the JS engine calls the terminal system API to help WEB APP1 indirectly access terminal system resources.

[0037] If WEB APP1 does not have the corresponding permissions, the JS engine will not respond to the interface call from WEB APP1 to the JS engine.

[0038] (7) When the user triggers a new WEB APP (referred to as WEB APP2), WEB APP2 runs in process1. Process1 supports multiple WEB APPs running simultaneously until the number of WEB APPs running in process1 reaches the upper limit due to certain business conditions (such as speed, stability and economy indicators). Then webapp_platform creates a new process process2 for the new WEB APP to run.

[0039] From the running process of the above WEB APP, we can know that multiple WEB APPs can be run in the same process at the same time, and the running code in the same process may share data and permissions. Therefore, the process permissions of the same process itself are the permission set of the permissions of the WEB APP running in the process, resulting in the permission range of the same process being too large. Moreover, the JS engine in the same process can also interpret and execute the JS code of all WEB APPs running in the process to access system resources on behalf of the WEB APP. Similarly, the engine permissions of the JS engine are also the permission set of the permissions of the WEB APP running in the process, and the engine permission range of the JS engine is also too large; if a malicious JS engine is used by mistake, the malicious engine may illegally access system resources due to its large number of permissions, causing the risk of user data leakage.

[0040] In summary, according to the WEB APP running method in the relevant technology, the same process and the JS engine in the process will have too much permissions, which will easily increase the risk of user data leakage, thereby threatening the data security of the terminal.

[0041] In response to the above problems, this application provides an application running method that can limit the process permissions of the same process and the engine permissions of the JS engine in the process, so as to reduce the risk of user data leakage and improve the data security of the terminal during application operation.

[0042] Figure 11 is a schematic flow chart of an application running method provided in an embodiment of the present application. The present application embodiment takes the method applied to a terminal as an example for explanation.

[0043] like Figure 1 As shown, the method 100 includes:

[0044] Step 101, in response to an opening operation on a first application, obtaining a first permission category to which a first application permission corresponding to the first application belongs, where the first application permission refers to permission for the first application to access system resources.

[0045] Among them, the first application is an application that can be used in the terminal without downloading and installing a client, which can be called a WEBAPP, such as a quick application, a small program, etc.

[0046] Taking the first application as a WEB APP as an example, during the operation of the WEB APP, the WEB APP operation platform pre-installed in the terminal needs to create an independent process for it, and the independent process includes a JS engine for interpreting and executing the JS code of the WEB APP, and also includes a permission control module for controlling the application permissions of the WEB APP to access system resources, as well as other auxiliary modules necessary for the operation of the WEB APP. However, since multiple WEB APPs can be run simultaneously in the same process, and the code in the same process may share data and permissions, the process permissions of the same process are too large, and the engine permissions of the JS engine in the process are also too large, and there is a risk of user data leakage. Therefore, in order to improve the security of terminal data during the operation of the application, this application provides a way to limit process permissions and engine permissions. Considering that process permissions and engine permissions are determined by the application permissions of the WEB APP running in the process, how to limit the application permissions of the WEB APP running in the process is the key to limiting process permissions and engine permissions. For example, if all web apps with the same type of application permissions are running in the process, then compared with web apps with different application permissions running in the process, the process permissions and engine permissions of the former are obviously smaller than those of the latter, which can achieve the purpose of limiting process permissions and engine permissions.

[0047] In order to achieve the purpose of limiting process permissions and engine permissions, in a possible implementation, terminal developers and application developers can classify applications according to the application permissions possessed by each application, and set permission category labels for them. When the terminal receives an operation to start the first application, it can obtain the first permission category to which the first application permission corresponding to the first application belongs, and then determine the process that the first application should run according to the first permission category, so as to ensure that applications with the same permission category can run in the same process, and then limit the process permissions of the process to the application permissions corresponding to the first permission category.

[0048] The first application permission is used to indicate the permission of the first application to access system resources. System resources are terminal resources called by calling the API of the terminal system. For example, system resources may include terminal microphone, camera, photo album, memo, information, file, user data, etc.

[0049] Regarding how to determine the first permission category to which the first application permission belongs, similar applications can be divided into the same application set, and a permission category can be set for each application set, so that the application permissions of each application in the application set all belong to the permission category; and regarding the method of dividing application sets, applications with similar application permissions can be divided into the same application set, applications with similar privacy levels can be divided into the same application set, or applications with similar application functions can be divided into the same application set; the division standard can also be artificially defined, and this embodiment does not constitute a limitation on this.

[0050] Step 102, determining a first process corresponding to a first permission category, wherein the first process permission of the first process is the application permission included in the first permission category, and applications of different permission categories run in different processes.

[0051] In order to limit the process permissions of a process and the engine permissions of a JS engine in the process, in one possible implementation, the terminal may determine the first process corresponding to the first permission category based on the first permission category, so that applications with the same permission category are run in the same process, while applications with different permission categories are run in different processes. The first process permissions corresponding to the first process are the application permissions included in the first permission category. Compared with applications with multiple application permissions running in the first process, the process permissions of the first process can be reduced from multiple permission categories to a single permission category, thereby achieving the purpose of limiting process permissions and the engine permissions of the JS engine in the process.

[0052] Step 103: Run the first application in the first process.

[0053] After the terminal determines the first process corresponding to the first permission category, the first application can be run in the first process. The corresponding first process can obtain the application JS code of the first application from the WEB APP running platform (application store), and the first engine (JS engine) in the first process interprets and executes the JS code, and remotely communicates with the background server of the first application through the first engine. Optionally, when the first application has the need to access system resources on the terminal, the first application can call the relevant interface of the first engine in the first process, and query the permission management service (permission management module) whether the first application has the first application permission to access the system resources. If it has the first application permission, the terminal API is called by the first engine to indirectly help the first application access system resources; if it does not have the first application permission, the first engine does not respond to the interface call request.

[0054] In summary, the present application provides an application running method that can limit process permissions: when the terminal receives an opening operation for the first application, the first permission category to which the first application permission corresponds to can be obtained, and the first process corresponding to the first permission category can be determined to control the first application to run in the first process corresponding to the first permission category, so that applications of the same permission category are run in the same process, and applications of different permission categories are run in different processes, so that the process permissions of the same process are limited to the application permissions contained in the same permission category. Compared with the related art that does not limit the application running in the process, the application running method provided by the present application can reduce the process permissions of the process from the application permissions corresponding to multiple permission categories to the application permissions corresponding to a single permission category. Similarly, the engine permissions of the engine in the process can also be reduced from the application permissions corresponding to multiple permission categories to the application permissions corresponding to a single permission category, thereby achieving the purpose of limiting process permissions and engine permissions during application operation, reducing the risk of user data leakage, and improving the security of terminal system resources.

[0055] Since multiple applications can be run in the same process, when the terminal receives an operation to start the first application, there may be two situations: a process has been created and a process does not exist. In the two situations, the way of determining that the first permission category corresponds to the first process may be different.

[0056] Figure 2 1 is a schematic flow chart of another application running method provided in an embodiment of the present application. The present application embodiment takes the method applied to a terminal as an example for explanation.

[0057] For example, Figure 2 As shown, the method 200 includes:

[0058] 201 , in response to an opening operation on a first application, obtaining a first permission category to which a first application permission corresponding to the first application belongs, where the first application permission refers to permission for the first application to access system resources.

[0059] The implementation of step 201 may refer to the above embodiment, and this embodiment will not be described in detail here.

[0060] 202 : If a created process exists, obtain a second process permission of the created process, where the second process permission is a permission set of application permissions for running applications in the created process.

[0061] Since multiple applications can be run simultaneously in the same process, when the first application is started, there may already be a first process associated with the first permission category corresponding to the first application, or there may not be a first process corresponding to the first permission category. Therefore, when determining the first process corresponding to the first permission category, it is necessary to conduct a specific analysis based on whether there is a created process.

[0062] In the case where there are already created processes, since it is necessary to make applications of the same permission category run in the same process, and applications of different permission categories run in different processes. Therefore, when the terminal determines that there are already created processes, the second process permissions of each created process can be obtained, and then the relationship between the second process permissions and the first permission category can be compared to determine whether the created process can be determined as the first process corresponding to the first permission category.

[0063] The second process permission of the created process is a permission set of application permissions of the application running in the created process; when the application of the same permission category is running in the same process, the second process permission of the created process is the application permission included in the permission category corresponding to the application running in the created process. For example, if the application running in the created process has the permission to call the camera, the process permission corresponding to the created process is the camera permission.

[0064] 203. Determine a first process corresponding to the first permission category based on the second process permission and the first permission category.

[0065] Correspondingly, the terminal determines the first process corresponding to the first permission category according to the relationship between the second process permission of the created process and the first permission category.

[0066] In the scenario where there is a created process, there may be two scenarios, for example, a first process corresponding to the first permission category exists in the created process, and a first process corresponding to the first permission category does not exist in the created process; correspondingly, in an exemplary example, step 203 may also include step 203A and step 203B.

[0067] Step 203A: When there is a match between the second process permission and the first permission category, the created process corresponding to the second process permission is determined as the first process corresponding to the first permission category.

[0068] When the terminal determines that there is a created process and the second process permission of the created process matches the first permission category, the created process corresponding to the matching second process permission can be directly determined as the first process corresponding to the first permission category, so that the first application runs in the created process.

[0069] Regarding the match between the second process permissions and the first permission category, it can be understood that the application permissions included in the first process permissions are highly similar to the application permissions included in the first permission category; it can also be understood that the process permission label of the created process is consistent with the permission category label corresponding to the first permission category.

[0070] Exemplarily, if before the first application is opened, there are created process A, created process B and created process C in the terminal, the second process permission corresponding to created process A is positioning permission, the second process permission corresponding to created process B is camera permission, the third process permission corresponding to created process C is payment permission, and the first permission category is camera permission, then created process B is determined as the first process corresponding to the first permission category, and the first application is run in created process B.

[0071] Optionally, considering the application running speed or certain business requirements, the number of applications running in the same process is not unlimited. When the number of applications running in a process reaches the limit, a new process may need to be recreated. When selecting the first process from the created processes, in addition to considering the relationship between the second process permission of the created process and the first permission category, the number of applications running in the created process also needs to be considered. Correspondingly, in an exemplary example, step 203A may also include step 203A1 and step 203A2.

[0072] Step 203A1: when there is a match between the second process permission and the first permission category, obtain the number of applications running in the created process corresponding to the second process permission.

[0073] Step 203A2: When the number of applications is lower than the number threshold, the created process is determined as the first process corresponding to the first permission category.

[0074] In the case where there is a created process and the second process permission of the created process matches the first permission category, the number of applications running in the created process may have reached the maximum limit. In order to avoid affecting the operation of the running applications, the first application may not be able to run in the created process. Taking the above situation into consideration, when the terminal determines that the second process permission of the created process matches the first permission category, the terminal can obtain the number of applications running in the created process corresponding to the second process permission, so as to determine whether the first application can continue to run in the created process based on the number of applications.

[0075] Optionally, if the number of applications running in the created process is lower than the quantity threshold, it means that the first application can be run in the created process without affecting the existing running applications in the created process, and the created process is correspondingly determined as the first process corresponding to the first permission category.

[0076] On the contrary, if the number of applications already running in the created process is higher than the number threshold, if you continue to add running applications to the created process, it will not only affect the normal operation of the existing running applications in the created process, but also cause the newly added first application to have problems such as running freezes. In order to ensure the running quality of the application, the terminal newly creates a first process corresponding to the first permission category, and the first process permission of the first process is consistent with the second process permission of the created process.

[0077] Exemplarily, if the second process permission and the first permission category of the created process B are both positioning permissions, but the number of running applications in the created process B reaches the quantity threshold, the terminal recreates the first process, and the first process permission of the first process is also a positioning permission.

[0078] Optionally, the quantity threshold can be a fixed value, for example, the quantity threshold can be 5; optionally, the quantity threshold can also be dynamically set according to the terminal performance, for example, if the current terminal load is low, the quantity threshold can be set relatively large, and if the terminal load is high, the quantity threshold can be set relatively small.

[0079] Considering the fact that the number of applications running in a process is limited, after the terminal runs for a period of time, there may be two or more created processes with the same process permissions. When selecting the first process from the created processes based on the second process permissions of the created processes and the first permission category, if there are at least two created processes whose second process permissions match the first permission category, the first process can be further selected based on the number of applications running in the created processes. For example, a created process with a relatively small number of applications and a number of applications below the quantity threshold is preferentially selected as the first process.

[0080] Since the application does not always remain running, the number of applications in the created process may change at any time. For example, if the number of applications is 0, considering the terminal power consumption saving strategy, in one possible implementation, if there are two or more created processes with the same process authority, by obtaining the number of running applications in each created process, if the number of applications in at least two created processes is lower than a threshold, the running applications in at least two created processes can be merged and run into a single created process.

[0081] Step 203B: if there is no second process permission matching the first permission category, create a first process corresponding to the first permission category.

[0082] Optionally, if the terminal determines that the second process permissions of the created process do not match the first permission category, that is, there is no second process permission that matches the first permission category, then it is necessary to create a new first process for the first permission category to run the first application corresponding to the first permission category.

[0083] 204. If no created process exists, create a first process corresponding to the first permission category.

[0084] Optionally, if the terminal determines that there is no created process, a first process corresponding to the first permission category may be directly created.

[0085] Optionally, in order to make it possible to clarify the second process permissions of each created process later, a process permission label can be set for the first process when creating the first process. The process permission label is consistent with the first permission category, so that the process required to run for subsequent application startup can be determined by comparing the relationship between the process permission label and the permission category label corresponding to the first permission category.

[0086] 205. Run the first application in the first process.

[0087] The implementation of step 205 may refer to the above embodiment, and this embodiment will not be described in detail here.

[0088] In this embodiment, by analyzing whether there is a created process, and if there is a created process, determining whether to determine the created process as the first process based on factors such as the second process permissions of the created process and the number of applications running in the created process, it can be ensured that applications with the same permission category are running in the same process, and the running performance of the application can be guaranteed. If there is no created process, the first process corresponding to the first permission category is directly created, and a process permission label is set for the first process, so as to facilitate subsequent matching based on the process permission label, and further ensure that applications of the same permission category run in the same process.

[0089] In addition to reducing the risk of user data leakage by limiting process permissions and engine permissions, since the permission control module is also involved in the verification when the application accesses system resources, if the permission control module is attacked by a malicious application, it will bypass the permission verification of the permission control module and illegally access system resources, which will also lead to user data leakage.

[0090] Figure 3 1 is a schematic flow chart of another application running method provided in an embodiment of the present application. The present application embodiment takes the method applied to a terminal as an example for explanation.

[0091] For example, Figure 3 As shown, the method 300 includes:

[0092] Step 301, in response to an opening operation on a first application, obtaining a first permission category to which a first application permission corresponding to the first application belongs, where the first application permission refers to permission for the first application to access system resources.

[0093] Step 302: determine a first process corresponding to a first permission category, wherein the first process permission of the first process is the application permission included in the first permission category, and applications of different permission categories run in different processes.

[0094] The implementation of step 301 and step 302 can refer to the above embodiment, and this embodiment will not be described in detail here.

[0095] Step 303: if there is a created process, create a second process, the second process is used to run the permission control service, and the permission control service is used to verify the application permissions of each application.

[0096] Different from the related art in which the permission control service and the application code and the JS engine executing the application code are executed in the same process, in this embodiment, an independent process is created to run the permission control service (permission control module). That is to say, during the operation of the terminal, when the first application is started (there is no created process at this time), two processes are created at the same time, one process is used to run the application, and the other process is used to run the permission control service, so that the permission control service and the application run in different processes, so as to increase the cost of the permission control service being attacked and reduce the risk of the permission control service being maliciously attacked.

[0097] In a possible implementation, when there is a created process, a second process is created at the same time, and the second process is used to independently run the permission control service and other necessary auxiliary modules for users to support the permission control service. The permission control service is used to verify the application permissions of each application.

[0098] Step 304, when the first application has an access request to the system resources, the target engine in the first process communicates with the permission management service in the second process to obtain the permission query result.

[0099] When the first application is running in the first process, if the first application has an access request to system resources, it is necessary to query the permission management service in the second process through the target engine (JS engine) in the first process to determine whether the first application has the application permission to access the system resources, so as to obtain the permission query result.

[0100] Step 305 : when the permission query result indicates that the first application has the first application permission to access the system resource, the system resource is accessed through the target engine.

[0101] If the permission query result indicates that the first application has the first application permission to access the system resource, the first application can call the terminal system API through the relevant interface of the target engine to indirectly access the system resource. On the contrary, if the permission query result indicates that the first application does not have the first application permission to access the system resource, the target engine does not respond to the system resource access request.

[0102] Figure 4 Schematic diagram of the principle of an application operation process provided by an embodiment of the present application. Figure 4 As shown, before the first application 401 is triggered, the first process 402 and the second process 403 have been created in the terminal, and the first process 402 and the second process 403 are created at the same time. The first process 402 is used to run applications with positioning-type permissions (the second application, the third application), and the codes of the second application and the third application are interpreted and executed by the JS engine in the first process 402 to run the second application and the third application; optionally, in response to the triggering operation of the first application 401 (the triggering operation is used to start the first application 401), since the first permission category corresponding to the first application 401 is camera-type permissions, which is different from the process permissions corresponding to the created process (the first process 402), the terminal creates a third process 405 for the first application 401, and the third process 405 is used to run applications with camera-type permissions. Optionally, during the operation of the first application 401, the application code of the first application 401 is interpreted and executed through the JS engine; when the first application 401 has the need to access system resources, the permission management module 404 in the second process 403 can be queried through the JS engine, and when the query result indicates that the first application 401 has access rights, the terminal system interface is called through the JS engine to indirectly access system resources.

[0103] In this embodiment, an independent process is created to run the permission management service, so that the permission management service runs independently outside the process run by the application code and the application engine, thereby increasing the attack cost of the permission management service by malicious application code and malicious engines, improving the security of the permission management service, and further reducing the risk of user data leakage.

[0104] In order to run applications of the same permission category in the same process, it is necessary to classify the applications in advance and set corresponding permission category labels for applications of the same category. Figure 5 1 is a schematic flow chart of another application running method provided in an embodiment of the present application. The present application embodiment takes the method applied to a terminal as an example for explanation.

[0105] For example, Figure 5 As shown, the method 500 includes:

[0106] Step 501: Obtain second application permissions of at least two second applications configured in the application platform, where the first application belongs to the second application.

[0107] In order to determine the first process that the first application should run according to the first permission category of the first application during the subsequent operation of the first application, the second applications on the application platform need to be classified in advance so that applications with similar application permissions are classified into one category, and applications with different application permissions are classified into different categories. The corresponding terminal obtains the second application permissions of at least two second applications configured in the application platform, and classifies the second applications based on the second application permissions.

[0108] Step 502: Classify the second applications based on the second application permissions to obtain at least one application set, wherein the second application permissions of the second applications included in the same application set belong to the same permission category.

[0109] Regarding the application classification method, in this embodiment, applications with similar application permissions can be classified into one category based on the similarity between the second application permissions to obtain at least one application set, and the second application permissions of the second applications included in the same application set belong to the same permission category.

[0110] For example, if the application permission of application A is coarse location permission, the application permission of application B is fine location permission, and the application permission of application C is camera call permission, and the coarse location permission and the fine location permission are similar permissions, then application A and application B can be divided into application set A, and the permission category corresponding to the application set is positioning permission; application C can be divided into application set B, and the permission category of application set B is camera permission.

[0111] Optionally, second applications with the same privacy level may be divided into the same application set according to the privacy level corresponding to each second application permission. This embodiment does not limit the specific division method of the second applications.

[0112] Step 503: Based on the second application permission of the second application included in the application set, a permission category label is set for the second application, where the permission category label is used to indicate the second permission category to which the second application permission belongs corresponding to the second application.

[0113] After at least one application set is divided, the same permission category label can be set for the second applications in the application set according to the second application permissions of the second applications included in the application set. The permission category label is used to indicate the second permission category to which the second application permissions of the second application belong.

[0114] For example, if three application sets are obtained after classification, application set A, application set B and application set C, application set A contains application 1, application 2, application 3 and application 4, application set B contains application 5, application 6, application 7, and application set C contains application 8, application 9 and application 10, then application 1 corresponds to permission category label A, application 5 corresponds to permission category label B, and application 10 corresponds to permission category label C.

[0115] Step 504 , when the second application has a newly added application permission and the newly added application permission does not belong to the second permission category, a prompt message is displayed during the running of the second application, and the prompt message is used to authorize the newly added application permission.

[0116] Since the application permissions of an application do not always remain unchanged, there may be new application permissions. In order to meet the update and iteration of subsequent application permissions without reducing the security of application operation, in one possible implementation, when the second application has new application permissions and the new application permissions do not belong to the corresponding second permission category, a prompt message is displayed during the operation of the second application. The prompt message is used to remind the user that the second application has new application permissions, and the user manually determines whether to authorize the new application permissions.

[0117] Step 505 , in response to a confirmation operation on the prompt information, allowing the second application to access the system resources corresponding to the newly added application permissions, and generating a newly added permission log of the second application.

[0118] If the user allows the second application to access the system resources corresponding to the newly added application permissions, a confirmation operation on the prompt information can be triggered, and the corresponding terminal receives the confirmation operation on the prompt information, allows the second application to access the system resources corresponding to the newly added application permissions, and generates a newly added permission log for the second application. The newly added permission log includes at least the second application information, the newly added application permission information, etc.

[0119] On the contrary, if the user does not allow the second application to access the system resources corresponding to the newly added application permission, a cancellation operation on the prompt information is triggered, and the corresponding terminal receives the cancellation operation on the prompt information and does not allow the second application to access the system resources corresponding to the newly added application permission.

[0120] Step 506: When the newly added permission log meets the classification optimization condition, the permission category label of the second application is updated based on the newly added application permission and the second application permission. The classification optimization condition at least includes a quantity condition or a time condition.

[0121] In the case where there are many second applications that have applied for new application permissions, it means that the original application classification results are no longer applicable to the application operation needs. If the original classification results are still used, it may cause the applications in the same process to apply for more additional application permissions, reducing the security of application operation. Therefore, in a possible implementation, when the new permission log meets the classification optimization conditions, the second applications can be reclassified based on the new application permissions and the original second application permissions to update the permission category labels of each second application to meet the security requirements of application operation after the application permission update iteration.

[0122] Optionally, the classification optimization condition can be a time condition, for example, if the generation time of the new permission log reaches a time threshold, the second application can be reclassified; the classification optimization condition can also be a quantity condition, for example, if the number of new permission logs is greater than a quantity threshold, the second application can be reclassified.

[0123] In this embodiment, by pre-classifying application permissions and setting permission category labels for applications, the application can be run in the process corresponding to the permission category based on the permission category represented by the permission category label during operation, ensuring that applications of the same permission category are run in the same process, limiting process permissions and engine permissions, and reducing the risk of user data leakage; in addition, when an application applies for new application permissions, through user authorization, it is possible to support the application's additional application permissions without reducing the security of the application's operation, thereby ensuring the flexibility of the use of application permissions; moreover, after meeting the classification optimization conditions, the application can be reclassified and the permission category label of the application can be updated to meet the optimization and iteration requirements of the application permissions.

[0124] Taking the application as a WEB APP as an example, the application running process in this embodiment is exemplified. Applying the application running method shown in the above embodiment, the application running process of the WEB APP can be summarized as follows:

[0125] 1. The terminal is pre-installed with a system module before leaving the factory (the system module can also be called a WEB APP operating platform or webapp_platform).

[0126] 1) Terminal developers and WEB APP application store business personnel jointly investigate and analyze the permission categories of mainstream WEB APP application permissions, and confirm the division method of application sets (or permission sets). For example, the positioning permission set may include coarse location permission, fine location permission, etc.; the camera permission set may include the permission to call the camera, the permission to call the album, etc.

[0127] 2) The WEB APP application store marks the permission category label of the WEB APP's application permission based on the research and analysis results of the WEB APP's application permission. For example, for a life service WEB APP, if the specific application permission it applies for is the rough location permission, then the permission category label is the positioning permission.

[0128] 3) The terminal developer pre-installs a system module (referred to as webapp_platform) in the terminal system for the execution of the WEB APP. Based on the research and analysis results of the WEB APP application permission categories, the developer pre-designs the process permission configuration and other related information (such as the specific application permission list corresponding to a certain permission category) for the subsequent establishment of processes with different permission categories.

[0129] 2. Start and run the WEB APP during terminal operation.

[0130] 1) During the terminal operation, the webapp_platform module is resident in the terminal system to respond to the user's start-up of the WEB APP in a timely manner.

[0131] 2) When the user triggers WEB APP1 by clicking or associating startup, webapp_platform obtains the permission category of WEB APP1 from the WEBAPP application store and creates two independent processes (referred to as process1 and process2).

[0132] Process1 includes the JS engine for executing the JS code of WEB APP1, and other necessary auxiliary modules for supporting the operation of WEB APP. And based on the permission category of WEB APP1, the permission scope of process1 is set and restricted. For example, if the permission category of WEB APP1 is positioning permission, the permission scope of process1 is only positioning permission (including coarse location permission and fine location permission).

[0133] Process2 includes the WEB APP permission control module and other necessary auxiliary modules to support WEB APP permission control.

[0134] Optionally, the permission scope of process1 may not be set according to the permission category of the first WEB APP, but may be preset according to the research results. The specific method can be adjusted according to the actual research and analysis results. For example, a survey of the application permission set of mainstream WEB APPs in the WEB APP application store found that a large number of WEB APPs applied for positioning permissions and camera permissions at the same time. In this case, webapp_platform can configure the newly created process to have both positioning permissions and camera permissions. If a large number of WEB APPs apply for positioning permissions at the same time, webapp_platform can configure the newly created process to have positioning permissions.

[0135] 3) process1 obtains the JS code of WEB APP1 from the WEB APP application store.

[0136] 4) The JS engine in process1 interprets and executes the JS code of WEB APP1 and remotely communicates with the background server of WEB APP1.

[0137] 3. WEB APP1 indirectly accesses terminal system resources.

[0138] 1) When WEB APP1 needs to access certain system resources on the terminal (ie, call certain APIs of the terminal system, such as microphone, camera, photo album, etc.), WEB APP1 calls the relevant interface of the JS engine.

[0139] 2) The JS engine queries the WEB APP permission control module to see whether WEB APP1 has the corresponding permissions to access terminal system resources (the application permissions of WEB APP1 are manually configured by the user, or there are certain permission policies in webapp_platform).

[0140] If WEB APP1 has the corresponding application permissions, the JS engine calls the terminal system API to help WEB APP1 indirectly access terminal system resources.

[0141] If WEB APP1 does not have the corresponding application permissions, the JS engine will not respond to the interface call from WEB APP1 to the JS engine.

[0142] 4. Multiple WEB APPs are running.

[0143] 1) When the user triggers a new WEB APP (referred to as WEB APP2), webapp_platform obtains the permission category of WEB APP2 from the WEB APP application store and determines the difference between the permission categories of WEB APP2 and WEB APP1. The goal is to make WEB APPs with similar permission categories run in the same process, and WEB APPs with greatly different permission categories run in different processes.

[0144] If the permission categories of WEB APP2 and WEB APP1 are slightly different (they have the same permission category), WEB APP2 runs in process1. Process1 supports multiple WEB APPs running at the same time, until the number of WEB APPs running in process1 reaches the upper limit due to certain business conditions (such as speed, stability and economy indicators, etc.), then webapp_platform creates a new process for the new WEB APP to run.

[0145] If the permission categories of WEB APP2 and WEB APP1 are significantly different, webapp_platform creates a new process (remembered as process2), and refers to the permission category information of WEB APP2 to set and limit the permission scope of process2.

[0146] 5. The WEB APP applies for permissions outside the scope of the process permissions.

[0147] 1) Since some or a small amount of application permissions actually applied for by the WEB APP may exceed the permission category set of the process, in this case, if the WEB APP obtains the user's authorization for such excessive permissions, the webapp_platform allows the WEB APP to apply for new application permissions, that is, allows the process where the WEB APP is located to obtain the corresponding excessive permissions, and records the log.

[0148] 2) Subsequent terminal manufacturer developers and WEB APP application stores can optimize the division method of process permission category sets based on the actual operation, WEB APP exceeding permissions, and the change iteration of WEB APP permission categories.

[0149] Figure 6 It is a structural diagram of an application running device provided in an embodiment of the present application.

[0150] For example, Figure 6 As shown, the device 600 includes:

[0151] A first acquisition module 601 is used to obtain, in response to an opening operation on a first application, a first permission category to which a first application permission corresponding to the first application belongs, where the first application permission refers to permission for the first application to access system resources;

[0152] A determination module 602 is used to determine a first process corresponding to the first permission category, where the first process permission of the first process is the application permission included in the first permission category, and applications of different permission categories run in different processes;

[0153] The running module 603 is used to run the first application in the first process.

[0154] Optionally, the determining module 602 is further configured to:

[0155] In the case where there is a created process, obtaining a second process permission of the created process, where the second process permission is a permission set of application permissions for running applications in the created process; and determining the first process corresponding to the first permission category based on the second process permission and the first permission category;

[0156] or,

[0157] In a case where the created process does not exist, the first process corresponding to the first permission category is created.

[0158] Optionally, the determining module 602 is further configured to:

[0159] In a case where the second process permission matches the first permission category, determining the created process corresponding to the second process permission as the first process corresponding to the first permission category;

[0160] In the case that there is no match between the second process permission and the first permission category, the first process corresponding to the first permission category is created.

[0161] Optionally, the determining module 602 is further configured to:

[0162] If the second process permission matches the first permission category, obtaining the number of applications running in the created process corresponding to the second process permission;

[0163] When the number of applications is lower than a number threshold, determining the created process as the first process corresponding to the first permission category;

[0164] The device also includes:

[0165] The first creation module is used to create the first process corresponding to the first permission category when the number of applications is higher than the number threshold, and the first process permission of the first process is consistent with the second process permission of the created process.

[0166] Optionally, the device further comprises:

[0167] A setting module is used to set a process permission label for the first process when the first process is created, and the process permission label is consistent with the first permission category.

[0168] Optionally, the device further comprises:

[0169] A second creation module is used to create a second process when there is a created process, wherein the second process is used to run a permission control service, and the permission control service is used to verify the application permissions of each application;

[0170] The operation module 603 is further used for:

[0171] When the first application has an access request to the system resource, communicating with the permission control service in the second process through the target engine in the first process to obtain a permission query result;

[0172] When the permission query result indicates that the first application has the first application permission to access the system resource, the system resource is accessed through the target engine.

[0173] Optionally, the device further comprises:

[0174] A second acquisition module, configured to acquire second application permissions of at least two second applications configured in the application platform, the first application belonging to the second application;

[0175] a classification module, configured to classify the second applications based on the second application permissions to obtain at least one application set, wherein the second application permissions of the second applications included in the same application set belong to the same permission category;

[0176] The second setting module is used to set a permission category label for the second application based on the second application permission of the second application included in the application set, wherein the permission category label is used to indicate a second permission category to which the second application permission belongs corresponding to the second application.

[0177] Optionally, the device further comprises:

[0178] A display module, configured to display a prompt message during the operation of the second application if the second application has a newly added application permission and the newly added application permission does not belong to the second permission category, wherein the prompt message is used to authorize the newly added application permission;

[0179] a resource access module, configured to allow the second application to access the system resources corresponding to the newly added application permission in response to a confirmation operation on the prompt information, and to generate a newly added permission log of the second application;

[0180] An updating module is used to update the permission category label of the second application based on the newly added application permission and the second application permission when the newly added permission log meets the classification optimization condition, and the classification optimization condition at least includes a quantity condition or a time condition.

[0181] In summary, the present application provides an application running method that can limit process permissions: when the terminal receives an opening operation for the first application, the first permission category to which the first application permission corresponds to can be obtained, and the first process corresponding to the first permission category can be determined to control the first application to run in the first process corresponding to the first permission category, so that applications of the same permission category are run in the same process, and applications of different permission categories are run in different processes, so that the process permissions of the same process are limited to the application permissions contained in the same permission category. Compared with the related art that does not limit the application running in the process, the application running method provided by the present application can reduce the process permissions of the process from the application permissions corresponding to multiple permission categories to the application permissions corresponding to a single permission category. Similarly, the engine permissions of the engine in the process can also be reduced from the application permissions corresponding to multiple permission categories to the application permissions corresponding to a single permission category, thereby achieving the purpose of limiting process permissions and engine permissions during application operation, reducing the risk of user data leakage, and improving the security of terminal system resources.

[0182] Figure 7 It is a structural diagram of a terminal provided in an embodiment of the present application.

[0183] For example, Figure 7 As shown, the terminal 700 in the present application may include one or more of the following components: a processor 710 and a memory 720 .

[0184] The processor 710 may include one or more processing cores. The processor 710 uses various interfaces and lines to connect various parts of the entire terminal 700, and executes various functions and processes data of the terminal 700 by running or executing instructions, programs, code sets or instruction sets stored in the memory 720, and calling data stored in the memory 720. Optionally, the processor 710 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 710 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 710, but may be implemented separately through a baseband chip.

[0185] The memory 720 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 720 includes a non-transitory computer-readable storage medium. The memory 720 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 720 may include a storage program area and a storage data area, wherein the storage program area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The operating system may be an Android system (including a system deeply developed based on an Android system), an IOS system developed by Apple (including a system deeply developed based on an IOS system) or other systems. The storage data area may also store data (such as a phone book, audio and video data, chat record data) created by the terminal 700 during use.

[0186] In addition, those skilled in the art will appreciate that the structure of the terminal 700 shown in the above figures does not limit the terminal 700, and the terminal may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the terminal 700 also includes a radio frequency circuit, a shooting component, a sensor, an audio circuit, a wireless fidelity (WiFi) component, a power supply, a Bluetooth component, and other components, which will not be described in detail here.

[0187] The terminal provided in the embodiments of the present application may specifically be a chip, component or module, and the terminal may include a connected processor and memory; wherein the memory is used to store instructions, and when the terminal is running, the processor may call and execute instructions so that the chip executes any one of the application running methods described above.

[0188] This embodiment provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer or a processor, the computer or the processor executes any one of the application running methods described above.

[0189] This embodiment also provides a computer program product including instructions. When the computer program product is executed on a computer or a processor, the computer or the processor executes the above-mentioned related steps to implement any one of the application running methods introduced above.

[0190] Among them, the terminal, computer-readable storage medium, computer program product or chip containing instructions provided in this embodiment are all used to execute the corresponding application running method provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here.

[0191] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0192] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0193] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An application running method, characterized in that: The method comprises: In response to an operation of opening a first application, obtaining a first permission category to which a first application permission corresponding to the first application belongs, where the first application permission refers to permission for the first application to access system resources; Determine a first process corresponding to the first permission category, where the first process permission of the first process is the application permission included in the first permission category, and applications of different permission categories run in different processes; The first application is run in the first process.

2. The method according to claim 1, characterized in that: The determining the first process corresponding to the first permission category includes: In the case where there is a created process, obtaining a second process permission of the created process, where the second process permission is a permission set of application permissions for running applications in the created process; and determining the first process corresponding to the first permission category based on the second process permission and the first permission category; or, In a case where the created process does not exist, the first process corresponding to the first permission category is created.

3. The method according to claim 2, characterized in that The determining, based on the second process permission and the first permission category, the first process corresponding to the first permission category includes: In a case where the second process permission matches the first permission category, determining the created process corresponding to the second process permission as the first process corresponding to the first permission category; In the case that there is no match between the second process permission and the first permission category, the first process corresponding to the first permission category is created.

4. The method according to claim 3, characterized in that The step of determining the created process corresponding to the second process permission as the first process corresponding to the first permission category when the second process permission matches the first permission category includes: If the second process permission matches the first permission category, obtaining the number of applications running in the created process corresponding to the second process permission; When the number of applications is lower than a number threshold, determining the created process as the first process corresponding to the first permission category; The method further comprises: When the number of applications is higher than the number threshold, the first process corresponding to the first permission category is created, and the first process permission of the first process is consistent with the second process permission of the created process.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: When the first process is created, a process permission label is set for the first process, and the process permission label is consistent with the first permission category.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If a process has been created, create a second process, where the second process is used to run a permission control service, where the permission control service is used to verify application permissions of each application; The running the first application in the first process includes: When the first application has an access request to the system resource, communicating with the permission control service in the second process through the target engine in the first process to obtain a permission query result; When the permission query result indicates that the first application has the first application permission to access the system resource, the system resource is accessed through the target engine.

7. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Acquire second application permissions of at least two second applications configured in the application platform, the first application belonging to the second application; Based on the second application permissions, classify the second applications to obtain at least one application set, wherein the second application permissions of the second applications included in the same application set belong to the same permission category; Based on the second application permission of the second application included in the application set, a permission category label is set for the second application, where the permission category label is used to indicate a second permission category to which the second application permission belongs corresponding to the second application.

8. The method according to claim 7, characterized in that The method further comprises: If the second application has a newly added application permission and the newly added application permission does not belong to the second permission category, displaying a prompt message during the running of the second application, the prompt message being used to authorize the newly added application permission; In response to a confirmation operation on the prompt information, allowing the second application to access the system resources corresponding to the newly added application permission, and generating a newly added permission log of the second application; When the newly added permission log meets the classification optimization condition, the permission category label of the second application is updated based on the newly added application permission and the second application permission, and the classification optimization condition at least includes a quantity condition or a time condition.

9. An application running device, characterized in that: The device comprises: A first acquisition module, configured to, in response to an opening operation on a first application, acquire a first permission category to which a first application permission corresponding to the first application belongs, wherein the first application permission refers to permission for the first application to access system resources; a determination module, configured to determine a first process corresponding to the first permission category, wherein the first process permission of the first process is the application permission included in the first permission category, and applications of different permission categories run in different processes; A running module is used to run the first application in the first process.

10. A terminal, characterized in that: The terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the terminal executes the application running method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes the application running method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the application running method according to any one of claims 1 to 8 is implemented.

Images